In a recent report, cybersecurity researchers from the ESET cybersecurity company highlighted that malware of the Scarab ransomware family has been deployed to spread its variants across global victim organizations using a malicious toolset named Spacecolon.
ESET has issued an advisory about the vulnerability of the toolset that may allow targeted attackers to penetrate victim organizations by exploiting commonly vulnerable web servers or using brute-force attacks against Remote Desktop Protocol (RDP) credentials to gain entry into victim organizations. As a result of ESET's investigation, it was also discovered that certain Spacecolon versions include Turkish strings, which suggests that a Turkish-speaking developer was involved in the development of these versions.
According to a detailed technical report released on August 22, 2023, by ESET security researcher Jakub Souek, the Spacecolon malicious toolkit is being used by a cyber campaign that is targeting organizations all over the world to spread various variants of the Scarab ransomware, and it is targeting anti-torture organizations in particular.
As of May 20, 2023, the most recent build of Spacecolon has been carried out, and the roots of the project can be traced back to as early as May 2020. Despite extensive tracking and analysis, ESET does not yet have an explanation as to what threat actor group is likely to be using the toolset to exploit the system. This has led to the name "CosmicBeetle" being used by the firm for the operators behind Spacecolon due to the similarity of their names.
The threat actor CosmicBeetle is reported to have infiltrated some companies through misconfigured web servers, and they attempt to brute-force login information for Remote Desktop Protocol (RDP) by accessing misconfigured web servers. There have been victims across several countries who have been identified as having been infected by the Spacecolon virus since May 2020. This includes France, Mexico, Poland, Slovakia, Spain, and Turkey.
An American school in Mexico was attacked by a group of hackers, who chose a hospital and tourist resort in Thailand as their targets, an insurance company in Israel, a Polish government organization, an entertainment company in Brazil, and a Turkish environmental company based in Turkey. Further, Cosmic Beetle may also target unpatched servers that have not yet been updated with security patches, attempting to infiltrate networks by exploiting these vulnerabilities.
The CosmicBeetle botnet deploys the main Spacecolon component used by CosmicBeetle to compromise vulnerable web servers after CosmicBeetle compromises the target web server. It is called ScHackTool. This type of attack relies heavily on the operating system's GUI and the active participation of operators; the GUI enables operators to orchestrate attacks and download and execute additional tools on demand, according to their requirements, on compromised machines.
A CosmicBeetle can deploy ScInstaller over the local network and use it to further secure the target. For example, it can use ScInstaller to install ScService, which provides even further remote access to the target.
Ultimately, CosmicBeetle deploys the Scarab ransomware variant as its final payload as a part of its campaign.
A clipboard monitoring software known as ClipBanker is deployed in this variant, which monitors the contents of the clipboard and changes any suspicious contents, e.g. cryptocurrency wallet addresses, into a controlled address that is controlled by the attacker.
Additionally, samples of a new ransomware family are being uploaded to VirusTotal from Turkey, suggesting that this family is being developed.
As a result of the research conducted by ESET, the company is convinced that this malware has been written by the same developers that wrote Spacecolon, a virus that has been named ScRansom by ESET. In addition to it encrypting all hard drives, removable drives, and remote drives, ScRansom also encrypts e-mail.
The ransomware has not yet been seen in the wild, and the development stage of this ransomware is still at a pre-release stage.
First discovered in February 2023, it is most likely that the attacks have changed intact as a result of the discovery of Spacecolon variants released by Zaufana Trzecia Strona.
Spacecolon is primarily composed of ScHackTool, an orchestrator based on Delphi that deploys an installer that, just as the name implies, installs ScService, a backdoor that can run customized commands, download and execute payloads, and extract information from compromised systems to obtain system information. It is also responsible for incorporating several third-party tools that are retrieved from a remote server, IP address 193.149.185.23, which can be accessed using ScHackTool. They are aimed at exploiting the access provided by ScService to introduce a ransomware variant called Scarab that has the goal of obtaining ransom money from the user.
The threat actors using Impacket to deliver ScService in place of ScHackTool is also another alternative infection chain identified by ESET, indicating that the threats are experimenting with different techniques to deploy ScService instead of ScHackTool.
The motives of CosmicBeetle have been financial, as the ransomware payload includes clipper malware that monitors the system clipboard and replaces cryptocurrency wallet addresses with ones the attacker controls through the use of file-sharing programs.
There is also evidence that suggests that there may be active development of another strain of ransomware known as ScRansom that is actively being developed. AES-128 can be used to encrypt hard drives, removable drives, and networked drives; the encryption key can be derived from a hard-coded string, making the variant suitable for cases when the encryption key must be derived from multiple sources.
A second issue with CosmicBeetle's malware is the lack of effort to conceal its presence, as well as the fact that their toolset leaves several artifacts behind when compromised machines are compromised, as well as a lack of robust anti-analysis and anti-emulation defenses.